AIKIDO-2026-10482
better-auth is vulnerable to Incorrect Authorization
24
Low Risk
This Affects:
better-authTL;DR
After a backup code was consumed, the plugin rewrote the remaining codes using the built-in encryption path even when the deployment configured plain text or a custom storeBackupCodes strategy. Subsequent verification could then fail for legitimate users, effectively breaking second-factor recovery. The fix re-saves remaining codes with the same strategy the application configured.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to Incorrect Authorization in versions 1.4.0 - 1.6.2.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.